The quantum query complexity of learning multilinear polynomials 



Ashley Montanaro* 
January 21, 2013 



Abstract 

In this note we study the number of quantum queries required to identify an unknown 
multihnear polynomial of degree d in n variables over a finite field Fg. Any bounded-error 
classical algorithm for this task requires r2(n'') queries to the polynomial. We give an exact 
quantum algorithm that uses 0{n'^~^) queries for constant d, which is optimal. In the case 
(7 = 2, this gives a quantum algorithm that uses 0{n'^~'^) queries to identify a codeword picked 
from the binary Reed-MuUer code of order d. 

1 Introduction 

A central problem in computational learning theory is to determine the complexity of identifying 
an unknown function of a certain type, given access to that function via an oracle. We say that a 
class J-' of functions can be learned using t queries if any function f G J-' can be identified with t 
uses of / (perhaps allowing some probability of error) . It is known that some classes of functions 
can be learned more efficiently by quantum algorithms than is possible classically. In particular, 
one of the earliest results in the field of quantum computation is that the class of linear functions 
F2 — 7- F2 (also known as Hadamard codewords) can be learned using a single quantum query [2], 
whereas 0(n) queries are required classically. Here we generalise this result to quantum learning 
of multilinear functions over general finite fields. 

Let ¥q denote the finite field with q = elements for some prime p. Every function / : — t- 
can be represented as a polynomial in n variables over Fg. / is said to be a degree d polynomial if 
it can be written as a polynomial whose every term is of total degree at most d. For example, the 
function / : F5 — )• F5 defined by f{x) = 2x\ + 4xf X2 + is a degree 3 polynomial. The set of 

polynomials of degree d in n variables over F^ is known as the (generalised) Reed-Muller code of 
order d over Fg. 

We say that a degree d polynomial / : F^ — ?■ Fg is multilinear if it can be written as 

SC[n\\S\<d ieS 

for some coefficients as S Fg, where [n] denotes the set {1, . . . , n}. Note that in the case 5 = we 
define HjeS-^* ~ example, any multilinear polynomial of degree 3 can be written as 

f{x) = 00 + ^ a^iyxi + ^ a^ijyXiXj + ^ a^ij^kjXiXjXk- 

i i<j i<j<k 
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Technically, such functions are multiaffine rather than multilinear, as they are affine in each variable; 
however, we use the "multilinear" terminology for consistency with prior work. In particular, note 
that in this terminology, linear functions / : — )■ Fg (i.e. functions such that f{x+y) = f{x)+f{y)) 
are equivalent to degree 1 multilinear polynomials with no constant term. In the important special 
case q = 2 (Boolean functions), every function / : Fg — F2 is multilinear. 

Given the ability to query a multilinear degree d polynomial / on arbitrary x G F", we would 
like to determine (learn) f using the smallest possible number of queries. A straightforward classical 
algorithm can solve this problem by querying /(x) for all strings x G F^ that contain only and 
1, and such that |x| < d. (We write \x\ for the Hamming weight of x G F^, i.e. the number of 
non-zero components.) To see this, first consider the special case where for some k, as = for all 
S such that IS"! < k. Then knowing /(x) for all x of the above form such that |x| = k is sufficient 
to determine all of the degree k coefficients of / (note that this relies on / being multilinear) . More 
generally, let fk denote the degree k part of /, i.e. 

fk{x)= ^ a^JJxj. 

SQ[n],\S\=k ieS 

For any k, once fi is known for all £ < k, the degree k + 1 coefficients can be determined from the 
inputs of Hamming weight k + 1: whenever / is queried on x, subtract Yle=o /^(^) from the result 
to simulate that as = for all S such that l^l < k. The algorithm can therefore learn / with 
certainty using 1 + + (2) + (3) + " ' ' + O queries, which is 0{n'^) for constant d. In the special 
case of functions / : Fg — )■ F2, all polynomials are multilinear. This implies that the class of all 
degree d polynomials / : Fg — ?■ F2 can be learned using 0{n'^) queries. 

It is also easy to see that the above algorithm is exactly optimal in an information-theoretic 
sense. As the number of distinct multilinear degree d polynomials of n variables over F^ is equal to 

gl+«+(2) + (3)+- + (d), 

and as a classical query to / only provides log2 q bits of information, any classical algorithm must 
make 1 + + (2) + (3) + ' ' ' + (rf) = ^{n'^) queries to / in order to identify it with certainty. A 
similar bound can be proven for bounded-error algorithms. Indeed, let / be picked uniformly at 
random, and consider an algorithm (without loss of generality deterministic) that makes at most c 
queries to / before it outputs an answer. Such an algorithm can output the correct answer for at 
most q'^ functions /, and hence succeeds with probability at most q'^~^^'^^~^i2)~^{-i)~^ '"(d)). 

Using similar techniques, one can find a lower bound for quantum query algorithms [8]. In the 
standard quantum query model, the algorithm accesses / via the unitary operation Of\x)\y) = 
|x)|y-|-/(x)), where x G F^, y G Fg. We formalise a lower bound on the number of queries required 
to identify / in this model as the following proposition^. 

Proposition 1. Let / : F^ — )• Fg he a multilinear degree d polynomial over Fg. Then any quantum 
query algorithm which learns f with bounded error must make J7(n'^~^) queries to f. 

Proof. Each query can be seen as a round of a communication process, where in each round the 
algorithm sends the registers |x) and \y) to the oracle, using (n + 1) log2 q qubits of communication; 
the oracle then performs the map |x)|y) 1— )• |x)|y-|-/(x)) and returns the registers to the algorithm. 
Let / be picked uniformly at random from the set of degree d multilinear polynomials, let X 

^In the case q = 2, this lower bound can also be obtained from independent results of Farhi et al [6] and Servedio 
and Gortler [13]. 
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be the corresponding random variable, and let Y be the random variable corresponding to the 
function which is output by the algorithm. By Holevo's theorem [7] (see also [3]), after r rounds of 
communication, the mutual information between X and Y satisfies the upper bound 

I{X : Y) < 2r(n + l)log2 9. 

On the other hand, Fano's inequality [4] states that the probability of identifying / incorrectly 
satisfies the lower bound 

P >1 I{X:Y) + 1 

' " log2 (gl+"+(2)+(3)+-+C.O^ ' 

which thus implies that 

p 2r(n + 1) + l/log2 9 



For this quantity to be upper bounded by a constant, we must have r = Q.{n'^~^). □ 

The main result of this note is that this asymptotic scaling can actually be achieved. 

Theorem 2. Let / : — )• Fg be a multilinear degree d polynomial over Fg. Then there is an exact 
quantum algorithm which learns f with certainty using 1 + Yli=i 2*^^ (j-i) Q'^s.ries to f, which is 
0{n'^^^) for constant d. 

The case d = 1, g = 2 of this result was previously proven by Bernstein and Vazirani [2], while 
a bounded-error quantum algorithm using 0(n) queries for the case d = 2, q = 2 was more recently 
given by Rotteler [12]; by contrast, the algorithm given here is exact and works for all d and all 
fields ¥q. In related work, a quantum algorithm for estimating quadratic forms over the reals using 
0(n) queries had previously been given by Jordan [9, Appendix D]. 



2 Proof of Theorem 2 



The only quantum ingredient we will need to prove Theorem 2 is the following lemma, which is 
implicit in [1, 5] and is a simple extension of the Bernstein- Vazirani algorithm [2] for identifying 
linear functions over F2. 

Lemma 3 ([1, 5]). Let / : F^ — )• Fg be linear, and let (7 : F^ — )• Fg be the function g{x) = f{x) + /3 
for some constant /3 G Fg. Then f can be determined exactly using one quantum query to g. 

For completeness, we give a full proof of Lemma 3 in Appendix A. 

We will derive a quantum algorithm to learn an unknown multilinear degree d polynomial / 
by introducing a linear function fs of n variables which can be produced using a relatively small 
number of queries to /, and from which / can be determined using Lemma 3. This technique is 
somewhat similar to the approach used to learn quadratic polynomials with bounded error in the 
work [12]. A related function was previously used by Kaufman and Ron [10] to produce an efficient 
classical tester for low-degree polynomials over finite fields. 

For any A;-subset S C [n], let Sj denote the j'th element of 5, where S is considered as an 
increasing sequence of integers. For i G [n], let denote the i'th element in the standard basis for 
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the vector space F^. For any / : — )• Fg and any subset 5 C [n], define the function : F^ — )• Fg 
as follows: 

fs{x)= J2 + 

/3i,...,/3fee{o,i} \ i=i / 

where the inner sum is over F^ and the outer sum is over ¥q. For example, for S = {1,2}, 
fsix) = f{x) — f{x + ei) — f{x + 62) + /(x + ei + 62). When q = 2, fs{x) sums / over the affine 
subspace of F2 positioned at x and spanned hy {ei : i £ S}. It is clear that a query to fs can be 
simulated using 2^ queries to /. One way of understanding fs is in terms of discrete derivative 
operators. If we define the discrete derivative of / in direction i G [n] as (Aj/)(x) = /(x + Cj) — /(x), 
then fsix) = (As'^Asj ...As,.f){x). In other words, fs is the function obtained by taking the 
derivative of / with respect to all of the variables in 5. 

We will be interested in querying fs for sets S of size d — 1. In this case, we have the following 
characterisation for multilinear polynomials /. 

Lemma 4. Let / : F^ — )• Fg be a multilinear polynomial of degree d with expansion 

f{x)= X] "Tj|xi. 

TC[n],\T\<d ieT 

Then, for any S such that \S\ = d — 1, 

fs{x) = 05 + ^ asu{k}Xk- 

k^S 



Lemma 4 follows easily from expressing fs in terms of discrete derivatives; we also give a simple 
direct proof in Appendix B. We are now ready to describe a quantum algorithm which uses fs to 
learn the degree d component of /. 



Algorithm 1: Learning the degree d component of / 


foreach S C [n] such that \S\ = d — 1 do 




Use one query to fs to learn the coefficients a^ujfc} 


for all k ^ S; 


end 




Output the function fd defined by fd{x) = Y.s<z[n],\s\=d 


as Ui&s^i' 



Correctness of this algorithm follows from Lemmas 3 and 4. By Lemma 4, for any S such that 
15"! = d — 1, knowledge of the degree 1 component of fs is sufficient to determine asu{k} for 
k ^ S. Therefore, knowing the degree 1 part of fs for all S C [n] such that jS"! = d — 1 is sufficient 
to completely determine all degree d coefficients of /. By Lemma 3, for any S with IS"! = d — 1, 
the degree 1 component of fs can be determined with one quantum query to fs- This implies that 
Algorithm 1 completely determines the degree d component of / using {^"li) queries to fs, each of 
which uses 2'^~^ queries to /. 

Once the degree d component of / has been learned, / can be reduced to a degree d — 1 
polynomial by crossing out the degree d part whenever the oracle for / is called. That is, whenever 
the oracle is called on x, we subtract fd{x) from the result (recall fd is the degree d part of /), at 
no extra query cost. Inductively, / can be determined completely using 
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queries; the last query is to determine the constant term a0, which can be achieved by classically 
querying /(O"). The number of queries used is therefore 0{n'^~~^) for constant d, completing the 
proof of Theorem 2. 
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A Quantum learning of linear functions 

In order to prove Lemma 3, we will use the quantum Fourier transform (QFT) over general finite 
fields. This was originally defined by de Beaudrap, Cleve and Watrous [1] and independently by 
van Dam, Hallgren and Ip [5]. The QFT over Fg is defined as the unitary operation 

where cj = e^'^*/^ (recall q = p^) and the trace function Tr : Fg — )■ Fp is defined by Tr(x) := 
X + + + • • • + . If g is prime (i.e. r = 1), then of course Tr(x) = x. The trace is linear: 
Tr(x + y) = Tr(x) + Tr(?/) (see [11] for the proof of this and other standard facts about finite fields). 
This allows the n-fold tensor product of QFTs to be written concisely as 



qnl2 



where x ■ y = Ylll=i ^iUii the sum being taken over Fg. 

For any function / : Fg — t- Fg, let Uf be the unitary operator that maps |x) i— )• oj^'^^f^'-^^'>\x) 
Given access to /, Uf can be implemented using a standard phase kickback trick as follows. 

Lemma 5 ([1, 5]). Uf can he implemented using one query to f. 
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Proof. To implement Uf, append an ancilla register \y), y G Fg, in the initial state |1). Apply 
to this register to produce 

then apply Of to both registers (recall Of\x)\y) = \x)\y + f{x))). For any x G Fg, the initial state 
|x)|l) is mapped to 

u~^<y^\y + f{x)) = ^\x)Y. =a;T^/(^)|x)^ J] u.-^'^^), 

where we use the linearity of the trace function. As the second register is left unchanged by Of, it 
can be ignored. □ 

We are now ready to prove Lemma 3. 
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Lemma 3 ([1, 5]). Let / : — )• Fg be linear, and let (7 : F^ — )• Fg be the function g{x) = /(x) + /3 
for some constant /3 G Fg. Then f can be determined exactly using one quantum query to g. 

Proof. First observe that / will be linear if and only if f{x) = a ■ x = aiXi for some a G F^ . 

Create the state 



q"" 
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n/2 



Tr{a-x+l3)i 



via the technique of Lemma 5, using one query to g. Now apply the n-fold tensor product of the 
inverse quantum Fourier transform to produce 

Note that (3 has been relegated to an unobservable global phase, and the sum over x will be zero 
unless y = a, in which case it will equal g". A measurement in the computational basis therefore 
yields a with certainty, which suffices to determine /. □ 



B Proof of Lemma 4 

We finally prove Lemma 4, which we restate for convenience. 

Lemma 4. Let / : F^ — t- Fg be a multilinear polynomial of degree d with expansion 

TQ[n],\T\<d ieT 

Then, for any S such that \S\ = d — 1, 

fs{x) = 05 + ^ asu{k}Xk- 
k^S 

Proof. For brevity, write = X]f=i ft- ^xy be the Dirac delta function {5xy = 1 if x = y, and 
lixy = otherwise). By the definition of fs, for any x G F^ we have 

fs{x) = E (- 

/3i,...,/3d-ie{0,l} 

= (-1)'^-^ E 

TC[n],|7 

Now note that for all T such that S T, the sum over . . . , will equal 0. This is because 
in this case there must exist an index j £ [d— 1] such that Sj ^ T, so for this j, f3j does not appear 
in the product over T. So, after summing over the /3j such that i 7^ j, we are left with the sum 



d-i 



\d-l- 



TCln],\T\<d ieT \ j=l 



d-l 



-\<d /3i,...A-ie{o,i} i&T \ j=i 
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J2i3j£{0 for some constant Kt; this evaluates to for any Kt- As I^I = d—1 and 

|T| < d, this imphes that we can rewrite fs{x) as 



fs{x) 



as claimed. 



+ 



+ 



/Ji,...,/3d-ie{0,l} i6S V i=l 



d-1 



i)'^-^E«5uw E (-1)'" n h^ + E^.^^. 

k^S /3i,..,/3d-ie{0,l} i6SU{fe} \ j=i 

E (-i)'^'n(^s>+A) 

A,-,/9d-ie{o,i} «=i 

d-i 

i)'-'E"^^uw E (-i)""-^^- n (-^5, + A) 

/3i,...,/3d-ie{0,l} i=l 

\^=i \fte{o,i} // V k^s / 

as + E "Su{fe}a;fc 



□ 
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